CVE-2024-9584

The Image Map Pro WordPress plugin (up to version 6.0.20) has a missing capability check on its AJAX functions, allowing authenticated attackers with contributor-level privileges or higher to add, update, or delete map projects. The issue is fixed in 6.0.21; upgrade to a version > 6.0.20 to re...

CVE-2024-9628

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'WpsTelegramChatAdmin::checkСonnection' function in versions up to, and including, 4.5.4. This makes it possible for authenticated attackers, wit...

CVE-2024-9628

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'WpsTelegramChatAdmin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, wit...

CVE-2024-9628

CVE-2024-9628 affects the WordPress plugin WPS Telegram Chat . The vulnerability arises from a missing capability check in the function Wps_Telegram_Chat_Admin::checkСonnection , in versions up to and including 4.5.4 . This design flaw enables authenticated attackers with subscriber-level access ...

CVE-2024-9109

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteoauthdata function in all versions up to, and including, 2.3.12. This makes it possible for authenticated attackers,...

CVE-2024-9109

CVE-2024-9109 affects the WordPress plugin “WooCommerce UPS Shipping – Live Rates and Access Points” up to version 2.3.11. The vulnerability stems from a missing capability check in the delete_oauth_data function, allowing authenticated attackers with Subscriber-level access or higher to delete t...

WordPress plugin Mapster WP Maps 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization...

PT-2024-39510 · WordPress · Mapster Wp Maps

Name of the Vulnerable Software and Affected Versions: Mapster WP Maps plugin for WordPress versions up to, and including, 1.5.0 Description: The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to an insufficient capability check on the mapster wp...

WordPress plugin WooCommerce UPS Shipping 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin WPS Telegram Chat 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-9531

CVE-2024-9531 affects MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution for WordPress. A missing capability check in mvx_sent_deactivation_request across versions up to 4.2.4 enables authenticated users with Subscriber+ privileges to trigger a canned email to the site admin...

CVE-2024-9531 MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvxsentdeactivationrequest' function in all versions up to, and including, 4.2.4. This makes it possible f...

The vulnerability of the Connector/ODBC driver for MySQL Connectors in the Oracle Database Management System allows a hacker to gain access to read, modify, or delete data, or to cause service interruptions.

The vulnerability of the Connector/ODBC driver for MySQL Connectors in the Oracle MySQL database management system is related to deficiencies in the authentication process due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, or delet...

CVE-2024-21166

...

The vulnerability of the Auctions component of the Oracle Sourcing supply management platform, a part of the Oracle E-Business Suite, allows a malicious individual to gain unauthorized access to create, modify, and delete data.

The vulnerability of the Auctions component of the Oracle Sourcing supply management platform, part of the Oracle E-Business Suite, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

The vulnerability of the Cloning component of the Oracle Global Lifecycle Management FMW Installer software platform allows a malicious individual to gain access to modify, add, and delete data.

The vulnerability of the Cloning component of the Oracle Global Lifecycle Management FMW Installer software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to the ability to modify, add, or delete...

The vulnerability of the FMW Control Plugin web interface of the Oracle Enterprise Manager Fusion Middleware Control software platform allows a attacker to disclose sensitive information and gain access to modify, add, or delete data.

The vulnerability of the FMW Control Plugin web interface of the Oracle Enterprise Manager Fusion Middleware software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to disclose sensitive information and gain access to the ability ...

The vulnerability of the Device Integration component of the Oracle MES for Process Manufacturing software solution, a part of the Oracle E-Business Suite, allows an intruder to gain unauthorized access to create, modify, and delete data.

The vulnerability of the Device Integration component of the Oracle MES for Process Manufacturing software solution, a part of the Oracle E-Business Suite, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gai...

CVE-2024-21096

...

CVE-2024-10003

CVE-2024-10003 (Rover IDX for WordPress) affects Rover IDX plugin, versions up to 3.0.0.2903. Root cause is a missing capability check on multiple functions, enabling authenticated attackers with subscriber-level access or higher to add, modify, or delete plugin options, potentially leading to un...